API Keys

Manage the LLM API keys (prefix sk-ar-) your workspace uses to call inference endpoints. List, create, inspect, update, and delete keys from a script or CI pipeline.

Request

The primary write route is POST /api/v1/keys, which mints a new LLM key. Send a JSON body:

Other routes

Response

POST /api/v1/keys returns the plaintext secret once alongside the key record:

{
  "key": "sk-ar-v1-actual-secret-only-shown-once",
  "data": {
    "id": "key_123",
    "hash": "f3b8...",
    "name": "ci-smoketest",
    "label": "sk-ar-v1",
    "created_at": "2026-04-24T00:00:00.000Z",
    "updated_at": null,
    "expires_at": null,
    "disabled": false,
    "real_usage": 0,
    "real_usage_daily": 0,
    "real_usage_weekly": 0,
    "real_usage_monthly": 0,
    "real_usage_monthly_requests": 0,
    "limit": null,
    "limit_remaining": null,
    "limit_reset": null,
    "include_byok_in_limit": false,
    "rate_limit": 30,
    "is_free_tier": true,
    "is_management_key": false,
    "creator_user_id": "user_123",
    "last_used_at": null,
    "allowed_models": ["openai/gpt-5.4-mini"],
    "allowed_endpoints": ["/api/v1/chat/completions"],
    "tpm": null
  }
}

limit_remaining is limit minus the key's spend in that window — a daily key's is measured over the last 24h, a weekly one over 7 days, and a monthly (or null) one over 30 days — so it can rise again as the window rolls.

POST /api/v1/keys/{hash}/rotate returns the same envelope with a new plaintext secret and the key's new hash. Everything else is carried over unchanged — id, name, limit, allowed_*, spend totals — so any /key?id= or api_key_id reference keeps resolving. The old secret stops authenticating the moment the call returns, so update every deployment holding it before you rotate. The request takes no body; two concurrent rotates of the same key are rejected with 409 rather than silently discarding one secret.

GET /api/v1/keys returns a { "object": "list", "data": [...] } envelope of key records (same shape, without the plaintext key). GET /api/v1/auth/key returns a compact record:

{
  "key": {
    "prefix": "sk-ar-v1",
    "name": "production-backend",
    "created_at": "2026-04-24T00:00:00.000Z",
    "rate_limit": 60,
    "usage": 128,
    "limit": null,
    "is_free_tier": true
  }
}

DELETE /api/v1/keys/{hash} performs a soft-delete and returns:

{
  "deleted": true,
  "id": "key_123"
}

Examples

curl https://anyrouter.dev/api/v1/keys \
  -X POST \
  -H "Authorization: Bearer ak_your-management-key" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "ci-smoketest",
    "rate_limit": 30,
    "allowed_models": ["openai/gpt-5.4-mini"],
    "allowed_endpoints": ["/api/v1/chat/completions"]
  }'

import httpx

resp = httpx.post(
    "https://anyrouter.dev/api/v1/keys",
    headers={"Authorization": "Bearer ak_your-management-key"},
    json={
        "name": "ci-smoketest",
        "rate_limit": 30,
        "allowed_models": ["openai/gpt-5.4-mini"],
        "allowed_endpoints": ["/api/v1/chat/completions"],
    },
)
print(resp.json()["key"])  # shown only once

const resp = await fetch("https://anyrouter.dev/api/v1/keys", {
  method: "POST",
  headers: {
    Authorization: "Bearer ak_your-management-key",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    name: "ci-smoketest",
    rate_limit: 30,
    allowed_models: ["openai/gpt-5.4-mini"],
    allowed_endpoints: ["/api/v1/chat/completions"],
  }),
})
const { key } = await resp.json() // shown only once

Errors

All key endpoints return the standard error envelope:

{
  "error": {
    "code": "authentication_required",
    "message": "Authentication required",
    "metadata": {
      "type": "authentication_error"
    }
  }
}